I've configured an ubuntu server with openssh in order to connect to it and execute commands from a remote system like a phone or a laptop. The problem is... I'm probably not the only one.

Is there a way to know all the login attempts that have been made to the server?

  • You should also consider running sshd on a non-standard port. Also, it is possible to set up iptables to deny new connection attempts if a single IP attempts a new ssh connection X times in a minute.
    – ivanivan
    Commented Dec 21, 2016 at 16:18
  • For me the issue was not fail2ban but sshguard, something I had never heard of
    – Ray Foss
    Commented Dec 21, 2017 at 18:49

8 Answers 8


On Ubuntu servers, you can find who logged in when (and from where) in the file /var/log/auth.log. There, you find entries like:

May  1 16:17:02 owl CRON[9019]: pam_unix(cron:session): session closed for user root
May  1 16:17:43 owl sshd[9024]: Accepted publickey for root from port 37384 ssh2
May  1 16:17:43 owl sshd[9024]: pam_unix(sshd:session): session opened for user root by (uid=0)
  • 2
    Out of curiosity, does Ubuntu have the lastb command?
    – Bratchley
    Commented May 1, 2014 at 14:39
  • 1
    @JoelDavis My Ubuntu 12.04 does, but the output is a single line that doesn't look like your output at all. Maybe it needs to be configure.
    – Anthon
    Commented May 1, 2014 at 17:22
  • Is this relevant?
    – Bratchley
    Commented May 1, 2014 at 17:39
  • 1
    On Ubuntu Server 14.04 and above, this should read /var/log/auth.log Commented Aug 2, 2017 at 12:13
  • This path doesn't seem to exist on Debian 12 - which seems odd since they are similar operating systems. Commented Jan 26 at 9:47

On Red Hat based distros such as Fedora/CentOS/RHEL you can check for the users logged in inside the file /var/log/secure.

If you want more information read this SuperUser Q&A titled: How can I log SSH access attempts and keep track of what SSH users end up doing on my server?.

  • 1
    There is no /var/log/secure on any of my Ubuntu systems.
    – Anthon
    Commented May 1, 2014 at 14:21
  • @Anthon, surprisingly I do not have /var/log/auth in my systems. That's why before posting the answer, I checked if I had /var/log/secure in my system, which is also a Ubuntu server :)
    – Ramesh
    Commented May 1, 2014 at 14:25
  • I had checked 14.04, 12.04 and and old machine under 8.04. Which version are you running? Done anything special to get that file?
    – Anthon
    Commented May 1, 2014 at 17:18
  • @Anthon, turns out the server in which I tested was RHEL. However, the answer in the link that I had provided was for Ubuntu which seems weird, since you had checked 3 variations of ubuntu and there is no /var/log/secure.
    – Ramesh
    Commented May 1, 2014 at 17:31
  • 6
    /var/log/secure is a Fedora/CentOS/RHEL ism.
    – slm
    Commented May 1, 2014 at 21:54

Note that the default configuration on Ubuntu is to NOT log ssh logins to the /var/log/auth file. This is the INFO logging level.

If you want to have it include login attempts in the log file, you'll need to edit the /etc/ssh/sshd_config file (as root or with sudo) and change the LogLevel from INFO to VERBOSE.

After that, restart the sshd daemon with

sudo service rsyslog restart

After that, the ssh login attempts will be logged into the /var/log/auth.log file.


On Ubuntu you can log in via SSH and use the Linux tail command to display the last x number of lines of your /var/log/auth.log file. When you’re logged in via SSH use the following command to view 100 last lines of your SSH log:

tail /var/log/auth.log -n 100

or even cleaner

tail -100 /var/log/auth.log | grep 'sshd'
  • 1
    Wouldn't an even cleaner way be: grep sshd /var/log/auth.log | tail -100? That way you know you're getting 100 sshd auth event items if there are 100 or more, unlike your commands.
    – Victor
    Commented May 22, 2023 at 22:38

My recommendation is to use auditd. This is logging using the linux kernel's audit subsystem and in my opinion the proper way to do it if you are serious. And given the nature of the question {security related} you should be using PAM as well. At the default level of just having auditd and PAM installed, you should automatically be getting all successful and unsuccessful SSH attempts logged in your audit.log file. So you really don't have to configure anything, just have auditd and PAM installed. I know this first hand for SLES. And would bet RHEL and any other enterprise version of linux would operate similarly.


within the raw audit log generated by auditd you can use either use something like aureport to filter it which is described in the auditd man pages, write your own text parser, or just use VI and search for keywords.

here is an except of my /var/log/audit/audit.log file with me ssh'ing into my linux server.

node=shark type=CRED_DISP msg=audit(1480622612.317:2211277): user pid=117768 uid=0 auid=23456 ses=2201 msg='op=PAM:setcred acct="ron" exe="/usr/sbin/sshd" (hostname=abc415.mycompany.us, addr=, terminal=ssh res=success)'
  • from the above, my server name is shark.
  • many lines like this are in audit.log, I want this one based on exe="/usr/sbin/sshd"
  • the uid of the account being ssh'd into is the value of auid, which is 23456 for this example
  • the name of the user account associated with auid is specified by acct="ron"
  • most times the audit system will record the dns hostname of the system trying to connect, but it always has it's ip address
  • the date of the entry which is in epoch time, so you'll have to convert that via something like date --date @1480622612.317 which results in Thu Dec 1 15:03:32 EST 2016 and is when I ssh'd into my server.

When res=failed is when you want to investigate those ip addresses and hostnames to see what systems were trying to connect, under what attempted user name. And obviously the successful ssh attempts to understand what's happening on your system - for example your coworker bob who sits at same desk everyday with hostname=bobscomputer and ip address=; if you see a successful ssh attempt at 2am yesterday under his username from ip address for example then it might be in your best interest to talk to bob to investigate. Possible hack attempt by someone else? And shortly after are there su attempts to root in audit log from bob's account?

when you see repetitive res=failed and auid=0 and acct=root then that's someone trying to ssh into your box into the root account, and is when you modify /etc/hosts.deny with that IP address for SSHD.


I know this is old but I wrote something to monitor successful and failed ssh connections/attempts. As well as banned IPs if you're using sshguard. The software is written in Python. It will email you when someone successfully connects via ssh, when someone gets the ssh password wrong or when someone is banned due to to many failed attempts. Hopefully this will help someone in the future who searches for this issue and finds my code!


For the python script, I wrote a bash script to monitor the process. It checks if it's running every minute via root cron task. If it is not running, it starts another process. Which is called by a root cron task every minute.


On my home SSH server, which is exposed to the internet, I do four things:

  1. Lock down SSH access to private keys only (no passwords)
  2. Use a non-standard port (e.g., 2299)
  3. Alert via Email whenever anyone successfully logs in
  4. Log all SSH session activity to files

Disallowing passwords ensures that it's virtually impossible for a random SSH scan to guess your username/password. The few times I've seen servers "hacked" it's usually due to password authentication being enabled. Assuming your users' private keys are not leaked, you can be reasonably sure that only authorized users can login to your server.

To lock down access to private keys, make sure that you have configured /etc/ssh/sshd_config with the following option:

PasswordAuthentication no

Changing the default port makes it less likely that an internet port scanner will find your service and possibly exploit some newly found vulnerability in OpenSSH. They will still find you, but this reduces the likelihood.

To use a non-standard port I have my router act as a NAT gateway and map the port to the internal server port 22. However, you could alter the port in the sshd_config file as well.

To setup alerting and session logging, I use a free tool called SSHLog (https://github.com/sshlog/agent/) -- I'm a contributor

You can configure it to send alerts whenever there's a successful login into the server. I use the following config for email in /etc/sshlog/conf.d/email_alert.yaml:

  - event: email_on_login
      - connection_established
      ignore_existing_logins: True
      - action: send_email

  - action: send_email
    plugin: email_action
    sender: [email protected]
    recipient: [email protected]
    subject: 'User {{username}} logged into {{hostname}}'
    smtp_server: smtp.mydomain.com
    smtp_port: 587
    username: 'user'
    password: 'pass'

Whenever a user logs in, I get an e-mail. If anyone did login, I can jump into the server and see every command entered by inspecting the logs in /var/log/sshlog/sessions/


The best thing i have ever come across for SSH commands logging is rootsh this tool allow administrator get every command from every sessions with extensive level of logging.

I have written a script to install and configure ROOTSH in ubuntu and CentOS/RHEL

download from github here is the link


chmod +x setup_rootssh.sh ; sudo ./setup_rootssh.sh
  • 1
    I think this is a bad way to promote your github profile... Basically you are asking to download a script from the web and execute it using root. Downvoted
    – UserK
    Commented Sep 10, 2019 at 23:56
  • I am not promoting my github profile i just tried to simplify things as people does above if you down vote me for promoting profile down vote them as well. moreover in rules guide of stack exchange nothing is written like that we can not share code files from personal repositories. Commented Sep 13, 2019 at 11:25
  • 2
    Please forgive my bad sense of humor. First of all thank you for the answer Mansur. The downvote comes from the fact that you are asking to execute a bunch of unknown commands as root user. Last time I did it there was a 'rm -R slash' inside.
    – UserK
    Commented Sep 13, 2019 at 11:37
  • 1
    Its ok, by the way stack-exchange won't allow me to such long codes that is why i put that script in my answer. Linux is very simple. Commented Sep 13, 2019 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .